Skip to content
OpenAdvisories
Low · 1.7 CVE-2026-57437 EUVD-2026-39428GHSA-p67v-3w7g-wjg7

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Published Jun 25, 2026 · Updated Jun 25, 2026 · Assigned by GitHub_M

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

Affected products

VendorProductAffectedFixed
sparklemotion nokogiri < 1.19.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-nokogiri 1.19.4+dfsg-1 —
Debian 13 ruby-nokogiri No fix yet —
Debian 12 ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ruby-nokogiri No fix yet —
Ubuntu 26.04 LTS ruby-nokogiri No fix yet —
Ubuntu 25.10 ruby-nokogiri No fix yet —
Ubuntu 24.04 LTS ruby-nokogiri No fix yet —
Ubuntu 18.04 LTS ruby-nokogiri No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 22.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 20.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 14.04 LTS ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 ruby-nokogiri 1.19.4-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rubygem-nokogiri 1.19.4-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems nokogiri < 1.19.4 1.19.4 GHSA-p67v-3w7g-wjg7

References